CVE-2006-6699

Multiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter to 1 calendarDialog.jsp or 2 fred.jsp. NOTE: the calendar.jsp vect...

CVE-2006-6697

CRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter...

CVE-2006-6697

CVE-2006-6697 describes a CRLF injection in Oracle Portal 10g and earlier (including 9.0.2) via webapp/jsp/calendar.jsp where an attacker can inject arbitrary HTTP headers and trigger HTTP response splitting by manipulating the enc parameter. Related entries note that CVE-2006-6699’s calendar.jsp...

Oracle Portal 10g HTTP Response Splitting

Oracle Portal/Applications HTTP Response Splitting -------------------------------------------------- Sample: http://target/webapp/jsp/calendar.jsp?enc=iso-8859-10d0aContent-length=120d0a0d0a3Cscript3Ealert'hi'3C/script3E How an attack can be conducted? ------------------------------- Oracle Port...

Oracle Portal 9.0.2 - Calendar.jsp Multiple HTTP Response Splitting Vulnerabilities

source: https://www.securityfocus.com/bid/21686/info Oracle Portal is prone to multiple HTTP response-splitting vulnerabilities because the application fails to properly sanitize user-supplied input. A remote attacker may exploit these vulnerabilities to influence or misrepresent how web content ...

phpBBHTTP应答分割攻击及跨站脚本执行漏洞 Exploit

No description provided by source. Ory Segal （[email protected]）提供了如下测试方法： 跨站脚本攻击： http://SERVER/phpBB2/search.php?searchauthor='scriptalertdocument.cookie/script HTTP应答分割 REQUEST POST /phpBB2/login.php HTTP/1.0 Host: SERVER User-Agent: Mozilla/4.7 en WinNT; I Accept-Encoding: gzip...

CVE-2006-6374

Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in 1 css/phpmyadmin.css.php, 2 dbcreate.php, 3 index.php, 4 left.php, 5...

CVE-2006-6374

Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in 1 css/phpmyadmin.css.php, 2 dbcreate.php, 3 index.php, 4 left.php, 5...

CVE-2006-6374

Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in 1 css/phpmyadmin.css.php, 2 dbcreate.php, 3 index.php, 4 left.php, 5...

CVE-2006-6374

The CVE-2006-6374 vulnerability affects PhpMyAdmin 2.7.0-pl2, with multiple CRLF injection flaws enabling HTTP header injection and response splitting via CRLF sequences in a PhpMyAdmin cookie. Affected components include css/phpmyadmin.css.php, db_create.php, index.php, left.php, libraries/sessi...

ASPNukelanguage_select.aspHTTP响应拆分漏洞 Exploit

No description provided by source. http://www.example.com/module/support/language/languageselect.asp?action=go&LangCode=trivero%0d%0aSet-Cookie%3Asome%3Dvalue 以下是HTTP首部示例： 请求： POST /module/support/language/languageselect.asp?action=go&LangCode=trivero%0d%0 aSet-Cookie%3Asome%3Dvalue HTTP/1.0...

PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting

Title : PhpMyAdmin 2.7.0-pl2 Path Disclosure | Multiple CRLF/Http Response Splitting Vulnerability Author : ajann Contact : : Tested : Just 2.7.0-pl2 CRLF------------------------------------------------------ Files---- /css/phpmyadmin.css.php /dbcreate.php /index.php /left.php...

Debian DSA-1207-2 : phpmyadmin - several vulnerabilities

The phpmyadmin update in DSA 1207 introduced a regression. This update corrects this flaw. For completeness, please find below the original advisory text : Several remote vulnerabilities have been discovered in phpMyAdmin, a program to administrate MySQL over the web. The Common Vulnerabilities a...

CVE-2006-5566

CRLF injection vulnerability in premium/index.php in Shop-Script allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the 1 linksexchange, 2 news, 3 searchwithchangecategoryability, 4 logging, 5 feedback, 6 showprice, 7 registe...

CVE-2006-5566

CRLF injection vulnerability in premium/index.php in Shop-Script allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the 1 linksexchange, 2 news, 3 searchwithchangecategoryability, 4 logging, 5 feedback, 6 showprice, 7 registe...

Shop-Script.txt

Vendor: Shop-Script a division of WebAsyst LLC Application: Shop-Script www.shop-script.com I. Descriptions: Shop-Script is a PHP based shopping cart. Multiple links of shop-script are vulnerable to a new form of application attack technique called HTTP Response splitting aka CRLF Injection. HTTP...

Multiple HTTP response splitting vulnerabilities in SHOP-SCRIPT

Vendor: Shop-Script a division of WebAsyst LLC Application: Shop-Script www.shop-script.com I. Descriptions: Shop-Script is a PHP based shopping cart. Multiple links of shop-script are vulnerable to a new form of application attack technique called HTTP Response splitting aka CRLF Injection. HTTP...

Shop-Script多个HTTP响应拆分漏洞

Shop-Script是基于PHP的购物车脚本。 Shop-Script的多个链接受HTTP响应拆分（也被称为CRLF注入）攻击的影响，允许攻击者更改HTTP响应头结构，导致破坏Web缓存、劫持页面或执行跨站脚本。 WebAsyst LLC Shop-Script 我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.shop-script.com/ 请求头 POST /premium/index.php?linksexchange=%0d%0aFakeHeader:FakeCustomHeader HTTP/1.0 Accept: / Content-Typ...

AEP SmartGate 4.3b (GET) Arbitrary File Download Exploit

Exploit for unknown platform in category remote exploits ======================================================== AEP SmartGate 4.3b GET Arbitrary File Download Exploit ======================================================== / prdelka-vs-AEP-smartgate ======================== Smartgate is an...

AEP SmartGate 4.3b - 'GET' Arbitrary File Download

/ prdelka-vs-AEP-smartgate ======================== Smartgate is an application layer security gateway that meets FIPS 140-2 requirements for large-scale networked environments for IP-based Networks. AEP provide network solutions for government, law enforcement, homeland security, public safety,...